Outbound REST with OAuth 2.0 profile (Azure) gives error.

[Jagrati Modi1]

Hi,

I need to work with the Azure Blueprints APIs so I created the OAuth Profile to 3rd party Providers. I've setup the OAuth Provider to provide the grant_type=client_credentials and provided my client_id and client_secret. To access the Azure Blueprint APIs, there is a requirement to add 'resource=https://management.azure.com' to the request, but I don't see support for that in the OAuth provider form. Thus, when the token comes back from Azure, it contains the wrong permissions and returns the below error:

{"error":{"code":"InvalidAuthenticationTokenAudience","message":"The access token has been obtained for wrong audience or resource '00000002-0000-0000-c000-000000000000'. It should exactly match with one of the allowed audiences 'https://management.core.windows.net/','https://management.core.windows.net','https://management.azure.com/','https://management.azure.com'."}}

How can I add the correct 'resource' parameter while creating the Azure OAuth Provider or is there any other way so that we can consume Azure REST API from ServiceNow?

I found the same thread but unfortunately this doesn't solves my problem. I am not sure where we can add the scripts or there is any other solution to this problem. Any help would be appreciated.

Thanks!

Jagrati

[Alan Roberts]

I managed to get this working for the ServiceBus API by copying the OAuthUtil script (System Definition / Script Includes) and adding the following to preprocessAccessToken

preprocessAccessToken: function(requestParamMap) {  
    requestParamMap.put("resource", "https://servicebus.azure.net");  
},

I then created a new Application Registry entry (System OAuth / Application Registry) for my Azure App that was told to use the above script for the OAuth API Script.  It also had my Azure Apps clientID and secret, the default grant type set to Client Credentials, the TokenUrl pointing to https://login.microsoftonline.com/<TENANT ID>/oauth2/token and the redirect URL to https://<name>.service-now.com/oauth_redirect.do.

Cheers

Alan

[Thanh Vo]

i did the same but changed the resource to "https://management.azure.com" and worked.

Thank you very much